Security

How your audio stays private

Everything on this page runs in production today, and every item can be checked.

Found something?

Email security@euphonaai.com. A rough email today beats a polished one next month; acknowledged within three working days.

Machine-readable: /.well-known/security.txt

How disclosure works →

In place today

What we do

Seven things, each of which is running in production right now and can be checked.

Your audio is reachable only through signed links

Audio is never served from the API and never sits behind a cookie. Every read or write is a short-lived signed URL scoped to one object and one operation, verified against the workspace it was minted for.

Untrusted audio is decoded in a sandbox

A malformed media file is the most direct attack surface an audio platform has, so decoding runs with its own user, network and process namespaces, no capabilities, a memory ceiling and a wall-clock deadline. It was built before there was any public upload path to attack.

Staff can't listen to your audio

Not support, not operations, not an administrator. There's no control anywhere in our internal tooling that plays a customer's audio, and no path that mints a link to it. There's no exception path today either: if we ever need to hear a file to debug it, we'll ask you, and any future grant mechanism will be one you start yourself and can see.

Every internal read of your data is recorded

Reads, not only writes. Our operations console can't show a member of staff anything about your account without first writing an audit record naming them, what they looked at and why, and if that record can't be written, the data isn't shown. The audit store is append-only and lives in a separate database from the one it audits.

Dangerous operations need a second look

Pausing part of the platform, rolling back a model, and anything similar are staged with a written reason and carried out after a delay, or immediately if it's an active incident, in which case the reason is written first and a postmortem is owed. Every one of them is on a review list the next morning.

Backups are encrypted before they touch the disk, and restored every week

Every database is dumped nightly straight into an encrypted file, there is never a plaintext copy on disk, and each dump is kept for fourteen days on our server and about two weeks more in an offsite copy, inside the 31 days our terms and privacy policy state. Every Sunday a drill restores the newest dump into a scratch database and checks that it answers queries, because a backup nobody has restored is a hope rather than a backup. Both have run on schedule since 18 September 2026.

Dependencies and the host are patched on a cadence

Unattended security updates on the origin, a hardened OS baseline, and firewall rules kept as code rather than as history in a shell. Application dependencies are updated on a schedule and on advisory.

Disclosure

Reporting something

Email security@euphonaai.com. Tell us what you found and how to reproduce it; you do not need a proof-of-concept exploit and we would rather you did not build one against live data.

We will acknowledge within three working days and tell you what we are doing. We will not threaten you, and we will credit you if you want to be credited. There is no bounty program, if one appears it will be on this page rather than negotiated by email.

Please do not access another person’s data, degrade the service for anyone else, or hold a finding for leverage. The machine-readable version of this is at /.well-known/security.txt.